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TITLE OF THE INVENTION 

> 

/ 

APPARATUS AND METHOD FOR EMBEDDING INFORMATION FOR TAMPER 
DETECTION AND DETECTING TAMPER AND RECORDING MEDIUM HAVING 
PROGRAM FOR CARRYING OUT THE METHOD RECORDED THEREON 

5 

BACKGROUND OF THE INVENTION 
Field of the Invention 

The present invention relates to an apparatus and a method 
for embedding information for tamper detection and detecting 

10 tamper, and a recording medium having a program for carrying out 
the method recorded thereon. More specifically, the present 
invention relates to an apparatus for embedding authentication 
data for tamper detection in a digital image signal, extracting 
embedded data therefrom to detect any partial change, in the 

15 digital image and localizing its position, a method carried out 
by the apparatus, and a recording medium having a program for 
carrying out the method recorded thereon. 

Description of the Background Art 

20 Recently, more and more information are available through 

the use of the Internet . Especially , WWW (World Wide Web) is being 
freguently used for transmitting and receiving information 
including images and audio. Under such network environment 
opened for everyone, however, an indefinite number of people can 

25 copy digital information such as an image without difficulty. 
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Further, the copied image can be easily edited or processed by 
image processing software available. Accordingly, there may be 
a case that a recipient of the digital image is not aware of any 
tamper therewith that may have been made by a third party during 
5 the transmission. 

Therefore, immediate establishment is required of a 
technique capable of determining whether the transmitted digital 
image has been tampered with or not . An electronic authentication 
technique has been conventionally known as one of the solutions. 

10 FIG. 14 is a diagram explaining an outline of the procedure 

of a conventional electronic authentication. 

A transmitting side subjects an original digital image to 
data compression by a hash function to generate a digest of the 
digital image, and then encrypts the digest with a secret key 

15 predetermined by the transmitting side. The transmitting side 
transmits the original digital image and the encrypted digest to 
a receiving side over the network. 

Similarly to the transmitting side, the receiving side 
first subjects the digital image received over the network to data 

20 compression by the hash function to generate a digest of the 
received digital image. The receiving side also decrypts the 
encrypted digest received over the network with a public key 
predetermined by the transmitting side. The receiving side 
compares the digest generated from the digital image with the 

25 decrypted digest. If the digests are identical with each other, 



the receiving side determines that the digital image has not been 
tampered with, and if not identical, determines that the digital 
image has been tampered with (electronic authentication) . 

In the conventional electronic authentication, however, 
5 the transmitting side needs to transmit two types of data, i.e. , 
the original digital image and the encrypted digest, to the 
receiving side. If there are many digital images, the 
transmitting side indispensably needs to manage which digest is 
for which digital image in order to correctly transmit such two 

10 types of data over the network. 

To avoid such management in the electronic authentication, 
(i.e., to avoid transmission of two types of data), a digital 
watermarking technique has been conventionally applied. The 
digital watermarking is a technique for embedding digital 

15 information in digital image data in an insensible form for human 
being. A typical prior art which relates to the electronic 
authentication applying the digital watermarking technique is 
disclosed in, for example, the document "PROCEEDINGS OF THE IEEE, 
VOL. 87, NO. 7, JULY 1999, pp. 1167 to 1180". 

20 Now, described is a case of applying the digital 

watermarking technique to the aforementioned electronic 
authentication using the digests. 

The transmitting side generates a digest of a digital image 
only for a predetermined number of high-order bits of the digital 

25 image (pixels) . Thereafter, the transmitting side encrypts the 



digest with a secret key predetermined by a transmitting side, 
and embeds the encrypted digest in low-order bits of the digital 
image. The transmitting side then transmits the digest-embedded 
digital image to the receiving side over the network. 
5 The receiving side extracts the encrypted digest embedded 

in the low-order bits of the digital image received over the 
network. The receiving side decrypts the extracted digest with 
a public key predetermined by the transmitting side. The 
receiving side also generates a digest, for verification, only 

10 for the predetermined number of high-order bits of the received 
digital image. The receiving side compares the generated digest 
with the decrypted digest. If the digests are identical with each 
other, the receiving side determines that the digital image has 
not been tampered with, and if not identical, determines that the 

15 digital image has been tampered with. 

With the conventional digital watermarking technique, 
however, it is possible to know that the digital image has been 
changed during its transmission, but can not localize the position 
that has been changed. 

20 Further, with the conventional digital watermarking 

technique, specific information is embedded utilizing high- 
frequency components which are normally insensible to human eyes . 
For this reason, if the digital image is subjected to irreversible 
image processing (compression and decompression) such as JPEG 

25 after being embedded with the information, such information is 




varied, making it impossible to extract the information correctly. 
That means that distinction is not possible between the tamper 
intentionally made by an unauthorized person and the change 
unintentionally caused by the ordinary irreversible image 
5 processing. 

Still further, the high frequency components normally 
corresponds to an edge and texture part of an image . Accordingly, 
if the image is much composed of a monotonous part (image with 
little contrast variation) , the information is not evenly 
10 embedded in the image (screen) . As a result, tamper with such 
monotonous part may not be detected. 

SUMMARY OF THE INVENTION 

Therefore, an object of the present invention is to provide 

15 an apparatus for embedding information for tamper detection and 
detecting tamper that embeds specific information not only in high 
frequency components but in entire image, i.e., in transform 
coefficients of relatively low frequency components, and later 
extracts the embedded information, a method carried out by such 

20 apparatus, and a recording medium having a program for carrying 
out the method recorded thereon. Therefore, it is possible to 
distinguish an intentional image tampering from a change 
unintentionally caused by irreversible image processing and 
further localize tampered position. 

25 The present invention has the following features to achieve 



the object above. 

A first aspect of the present invention is directed to an 
apparatus for embedding predetermined information for tamper 
detection in a digital image signal, comprising: 
5 a band division portion for dividing the digital image 

signal into a plurality of frequency bands; 

an authentication data generation portion for generating 
a pseudo-random number series by using predetermined key data, 
and generating authentication data from the pseudo-random number 
10 series; 

a key data embedding portion for embedding the key data in 
transform coefficients of a lowest frequency band (MRA) among the 
plurality of frequency bands; 

an authentication data embedding portion for embedding 
15 authentication data in transform coefficients of the frequency 
bands exclusive of MRA (MRR) among the plurality of frequency 
bands ; and 

a band synthesis portion for reconstructing the digital 
image signal in which the information has been embedded by using 
20 MRA and MRR to which data embedding processing is subjected. 

As described above, in the first aspect, a digital image 
signal is hierarchically divided into frequency bands, and then 
the authentication data is embedded in the transform coefficients 
of MRR. The authentication data is generated from a pseudo-random 
25 number series by using the key data, and the key data is embedded 



in the transform coefficients of MRA . As such, the information 
is embedded in the transform coefficients of relatively low 
frequency components. Accordingly, if the image is subjected to 
an irreversible image processing, variation in the embedded key 
5 data and authentication data is small comparing to that caused 
by the intentional image tampering. It is therefore possible to 
distinguish between the changes caused by the irreversible image 
processing and the intentional image tampering in the tamper 
detecting apparatus . Further, in the first aspect , it is not easy 

10 for a third party to decipher the authentication data because 
he/she does not know specifics of frequency bands and transform 
coefficients in which the information is embedded, the order of 
reading the transform coefficients, and the key data, thereby 
preventing overwriting or replacement of the embedded 

15 information. 

Herein, as a preferable method of embedding the 
authentication data , 

a set value T (T is a positive integer) and a set value m 
(m is an integer not more than T) are predetermined and q is 

20 predetermined as a value obtained by dividing a transform 
coefficient is divided by a predetermined quantization step size, 
and 

the authentication data embedding portion embeds the 
authentication data in each transform coefficient of MRR by 
25 comparing an absolute value of the transform coefficient with the 



set value T, and if the absolute value is less than the set value 
T, setting the transform coefficient to the set value +m or - 
m depending on a bit value of the authentication data to be embedded, 
and if the absolute value is not less than the set value T , setting 

. 5 the transform coefficient to an even or odd integer nearest to 
the value q depending on the bit value of the authentication data 
to be embedded. 

In this manner, information can be embedded with high 
accuracy and with less deterioration in image quality. 

10 A second aspect of the present invention is directed to an 

apparatus for detecting tamper with a digital image based on 
tamper-detection-information embedded by a specific apparatus in 
a digital image signal, comprising: 

a band division portion for dividing the digital image 

15 signal into a plurality of frequency bands; 

a key data extraction portion for extracting key data 
embedded by the specific apparatus from transform coefficients 
of MRA among the plurality of frequency bands; 

an authentication data generation portion for generating 

20 a pseudo-random number series by using the key data, and 
generating authentication data from the pseudo-random number 
series ; 

an embedded information extraction portion for extracting 
embedded information embedded based on the key data by th'e 
25 specific apparatus from transform coefficients of MRR among the 



plurality of frequency bands; and 

a tamper determination portion for comparing the embedded 
information with the authentication data for verification and 
determining whether the digital image has been tampered with. 
5 Further, the tamper determination portion preferably 

comprises : 

a block division portion for dividing the digital 
image into a plurality of unit blocks each composed of a 
predetermined number of pixels; 

10 a regional embedded information read portion for 

reading, for each of the unit blocks, embedded information 
embedded in the transform coefficients of MRR that represents the 
same spatial region as the unit block, serially from all of the 
embedded information extracted by the embedded information 

15 extraction portion; 

a regional authentication data read portion for 
reading, for each of the unit blocks, authentication data 
corresponding in position to the embedded information serially 
read by the regional embedded information read portion, serially 

20 from all of the authentication data generated in the 
authentication data generation portion; and 

a block-tamper determination portion for comparing 
a series of the embedded information serially read with a series 
of the authentication data serially read and determining, for each 

25 of the unit blocks, whether the digital image has been tampered 
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with . 

As described above, in the second aspect, the digital image 
is divided into unit blocks each composed of a predetermined 
number of pixels. For each unit block, information embedded in 
5 the transform coefficients of MRR that represents the same spatial 
region as the unit block is read. The read information is compared, 
for verification, with the authentication data assumed to have 
been embedded in the tamper-detection-information embedding 
apparatus. In this way, the tampered position on the digital 

10 image can be localized on a regional basis of unit block . Further , 
in the tamper-detection-information embedding apparatus, the 
information is embedded in the transform coefficients of 
relatively low frequency components. Accordingly, if the image 
is subjected to an irreversible image processing, variation in 

15 the embedded key data and authentication data is small comparing 
to that caused by the intentional image tampering. It is 
therefore possible to distinguish between the changes caused by 
the irreversible image processing and the intentional image 
tampering. 

20 Herein, as a preferable method of extracting the 

authentication data , 

a set value T (T is a positive integer) is predetermined 
and q is predetermined as a value obtained by dividing a transform 
coefficient by a predetermined quantization step size and then 

25 rounding off the result, and 
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the embedded information extraction portion extracts the 
embedded information from each transform coefficient of MRR by- 
comparing an absolute value of the transform coefficient with the 
set value T, and if the absolute value is less than the set value 
5 T, determining whether a value of the transform coefficient is 
positive or negative and extracting a bit value of embedded 
information embedded in the transform coefficient based on the 
determination, and if the absolute value is not less than the set 
value T , determining whether the value q is even or odd and 
10 extracting a bit value of embedded information embedded in the 
transform coefficient based on the determination. 

In this manner, information can be extracted with high 
accuracy and with less deterioration in image quality. 

A third aspect of the present invention is directed to a 
15 method of embedding predetermined information for tamper 
detection in a digital image signal, comprising: 

a step of dividing the digital image signal into a plurality 
of frequency bands; 

a step of generating a pseudo-random number series by using 
20 predetermined key data, and generating authentication data from 
the pseudo-random number series; 

a step of embedding the key data in transform coefficients 
of MRA among the plurality of frequency bands; 

a step of embedding the authentication data in transform 
25 coefficients of the frequency bands of MRR among the plurality 



of frequency bands; and 

a step of reconstructing the digital image signal in which 
the information has been embedded by using MRA and MRR to which 
data embedding processing is subjected. 
5 As described above, in the third aspect, a digital image 

signal is hierarchically divided into frequency bands, and then 
the authentication data is embedded in the transform coefficients 
of MRR. The authentication data is generated from a pseudo-random 
number series by using the key data, and the key data is embedded 

10 in the transform coefficients of MRA. As such, the information 
is embedded in the transform coefficients of relatively low 
frequency components. Accordingly, if the image is subjected to 
an irreversible image processing, variation in the embedded key 
data and authentication data is small comparing to that caused 

15 by the intentional image tampering. It is therefore possible to 
distinguish between the intentional image tampering and the 
change unintentionally caused by irreversible image processing 
when any tamper is detected. Further, in the third aspect, it 
is not easy for a third party to decipher the authentication data 

20 because he/she does not know specifics of frequency bands and 
transform coefficients in which the information is embedded, the 
order of reading the transform coefficients, and the key data, 
thereby preventing overwriting or replacement of the embedded 
information . 

25 Herein, as a preferable method of embedding authentication 



data , 

a set value T and a set value m are predetermined and q is 
predetermined as a value obtained by dividing a transform 
coefficient by a predetermined quantization step size, and 
5 the step of embedding authentication data includes: 

a step of comparing an absolute value of the transform 
coefficient with the set value T; 

a step of setting the transform coefficient to the set 
value +m or -m depending on a bit value of the authentication data 
10 to be embedded if the absolute value is less than the set value 
T; and 

a step of setting the transform coefficient to an even 
or odd integer nearest to the value q depending on the bit value 
of the authentication data to be embedded if the absolute value 
15 is not less than the set value T. 

In this manner, information can be embedded with high 
accuracy and with less deterioration in image quality. 

A fourth aspect of the present invention is directed to a 
method of detecting tamper with a digital image based on 
20 tamper-detection-information embedded by a specific apparatus in 
a digital image signal, comprising: 

a step of dividing the digital image signal into a plurality 
of frequency bands; 

a step of extracting key data embedded by the specific 
25 apparatus from transform coefficients of MRA among the plurality 
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of frequency bands; 

a step of generating a pseudo-random number series by using 
the key data, and generating authentication data from the 
pseudo-random number series; 
5 a step of extracting embedded information embedded based 

on the key data by the specific apparatus from transform 
coefficients of MRR among the plurality of frequency bands; and 

a step of comparing the embedded information with the 
authentication data for verification and determining whether the 
10 digital image has been tampered with. 

Further, the step of determining tamper preferably 
includes : 

a step of dividing the digital image into a plurality of 
unit blocks each composed of a predetermined number of pixels; 
15 a step of reading, for each of the unit blocks, embedded 

information embedded in MRR that represents the same spatial 
region as the unit block, serially from all of the embedded 
information ; 

a step of reading, for each of the unit blocks, 
20 authentication data corresponding in position to the embedded 
information serially read, serially from all of the 
authentication data; and 

a step of comparing a series of the embedded information 
serially read with a series of the authentication data serially 
25 read and determining, for each of the unit blocks, whether the 



digital image has been tampered with. 

As described above f in the fourth aspect, the digital image 
is divided into unit blocks each composed of a predetermined 
number of pixels. For each unit block, information embedded in 
5 the transform coefficients of MRR that represents the same spatial 
region as the unit block is read. The read information is compared, 
for verification, with the authentication data assumed to have 
been embedded when embedding the information. In this way, the 
tampered position on the digital image can be localized on a 

10 regional basis of unit block. Further, when embedding the 
tamper-detection-information, the information is embedded in the 
transform coefficients of relatively low frequency components. 
Accordingly, if the image is subjected to an irreversible image 
processing, variation in the embedded key data and authentication 

15 data is small comparing to that caused by the intentional image 
tampering. It is therefore possible to distinguish between the 
changes caused by the irreversible image processing and the 
intentional image tampering. 

Herein, as a preferable method of extracting the 

20 authentication data, 

a set value T is predetermined and q is predetermined as 
a value obtained by dividing a transform coefficient by a 
predetermined quantization step size and then rounding off the 
result, and 

25 the step of extracting embedded information includes: 




a step of comparing an absolute value of the transform 
coefficient with the set value T; 

a step of determining whether a value of the transform 
coefficient is positive or negative if the absolute value is less 
5 than the set value T , and extracting a bit value of embedded 
information embedded in the transform coefficient based on the 
determination ; 

a step of determining whether the value q is even or odd 
if the absolute value is not less than the set value T, and 
10 extracting a bit value of embedded information embedded in the 
transform coefficient based on the determination. 

In this manner, information can be extracted with high 
accuracy and with less deterioration in image quality. 

Furthermore , the tamper-detection-information 

15 embedding/tamper detecting method described in the above third 
and fourth aspects is typically realized by a computer device 
structured by a storage device (ROM, RAM, hard disk, etc.) storing 
predetermined program data capable of carrying out each of the 
above described steps and a CPU executing the program data. The 
20 program data may also be supplied to the computer device via a 
storage medium (CD-ROM, floppy disk, etc.) . 

These and other objects, features, aspects and advantages 
of the present invention will become more apparent from the 
following detailed description of the present invention when 
25 taken in conjunction with the accompanying drawings. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a block diagram showing the structure of a 
tamper-detection-information embedding apparatus 1 according to 
one embodiment of the present invention. 
5 FIG. 2 is a block diagram showing the structure of a tamper 

detecting apparatus 2 according to the embodiment of the present 
invention. 

FIG. 3 is a flowchart showing the processing carried out 
by the tamper-detection-information embedding apparatus 1 in FIG . 
10 1 . 

FIG. 4 is a block diagram exemplarily showing the structure 
of a band division portion 11 in FIG. 1. 

FIG. 5 is a block diagram exemplarily showing the detailed 
structure of a first band dividing filter 100 in FIG. 4. 
15 FIG. 6 is a diagram illustrating, in a two-dimensional 

frequency region, signals subjected to discrete wavelet 
transform . 

FIG. 7 is a flowchart showing the processing carried out 
by an authentication data embedding portion 14 in FIG. 1. 
20 FIG. 8 is a block diagram exemplarily showing the structure 

of a band synthesis portion 15 in FIG. 1. 

FIG. 9 is a diagram exemplarily showing the structure of 
a first band synthesis filter 400 in FIG. 8. 

FIG. 10 is a flowchart showing the processing carried out 
25 by the tamper detecting apparatus 2 in FIG. 2. 



FIG. 11 is a flowchart exemplarily showing the processing 
carried out by an embedded information extraction portion 23 in 
FIG. 2. 

FIG. 12 is a diagram schematically showing transform 
5 coefficients of LH3 and LH2 signals representing the same spatial 
region as a block of 32 by 32 pixel size. 

FIG. 13 is a diagram exemplarily explaining a computation 
under XOR. 

FIG. 14 is a diagram explaining an outline procedure of a 
10 conventional electronic authentication. 

DESCRIPTION OF THE PREFERRED EMBODIMENTS 

FIG. 1 is a block diagram showing the structure of an 
apparatus 1 for embedding information for tamper detection 

15 (hereinafter, referred to as tamper-detection-information 
embedding apparatus 1) according to one embodiment of the present 
invention. FIG. 2 is a block diagram showing the structure of 
a tamper detecting apparatus 2 according to the embodiment of the 
present invention . 

20 In FIG. 1, the tamper-detection-information embedding 

apparatus 1 includes a band division portion 11 , an authentication 
data generation portion 12, a key data embedding portion 13, an 
authentication data embedding portion 14, and a band synthesis 
portion 15. In FIG. 2, the tamper detecting apparatus 2 includes 

25 the band division portion 11, a key data extraction portion 21, 
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a key data determination portion 22, the authentication data 
generation portion 12 , an embedded information extraction portion 
23, a regional embedded information read portion 24, a regional 
authentication data read portion 25, and a block-tamper 
5 determination portion 26. 

The band division portion 11 and the authentication data 
generation portion 12 of the tamper detecting apparatus 2 are 
structurally the same as those of the tamper-detection- 
information embedding apparatus 1, and therefore, are provided 
10 with the same reference numerals and description thereof is 
omitted . 

Hereinafter, by further referring to FIGS. 3 to 13, 
described is the procedural flow of a method for detecting tamper 
with a digital image which is carried out by the tamper- 

15 detection-information embedding apparatus 1 and the tamper 
detecting apparatus 2 according to the embodiment. 

First, by referring to FIGS. 1 and 3 to 9, a method of 
embedding information which is carried out by the tamper- 
detection-information embedding apparatus 1 is described. 

20 FIG. 3 is a flowchart showing processing carried out by the 

tamper-detection-information embedding apparatus 1 of the 
embodiment . 

Described by referring to FIGS . 4 to 6 is processing carried 
out by the band division portion 11 that subjects a digital image 
25 signal to conventional discrete wavelet transform to divide a band 
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of the signal into three hierarchies. FIG. 4 is a block diagram 
exemplarily showing the detailed structure of the band division 
portion 11 in FIG. 1. In FIG. 4, the band division portion 11 
is provided with first to third band dividing filters 100, 200, 
5 and 300, all of which are identical in structure. 

Each of the first to third band dividing filters 100 to 300 
divides an incoming image signal into four frequency bands and 
obtains wavelet coefficients (hereinafter, referred to as 
transform coefficients) for every frequency band (step S301) . 

10 Here, the transform coefficients may be equivalently obtained by 
sub-band division . The first band dividing filter 100 of the band 
division portion 11 receives a digital image signal 71. 

The first band dividing filter 100 divides the digital image 
signal 71 into four signals varied in bands, i.e. , a signal LL1 , 

15 signal LH1, signal HL1 , and signal HH1 (hereinafter, collectively 
referred to as first hierarchical signal) , on the basis of 
parameters of horizontal and vertical frequency components. The 
second band dividing filter 200 receives only the signal LL1 which 
has the lowest band in the first hierarchical signal, and then 

20 again divides the signal into four signals varied in bands, i.e. , 
a signal LL2 , signal LH2 , signal HL2 , and signal HH2 (hereinafter, 
collectively referred to as second hierarchical signal) . Then, 
the third band dividing filter 300 receives only the signal LL2 
which has the lowest band in the second hierarchical signal, and 

25 again divides the signal into four signals varied in bands, i.e. , 
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a signal LL3 , signal LH3 , signal HL, and signal HH3 (hereinafter, 
collectively referred to as third hierarchical signal) . 

FIG. 5 is a block diagram exemplarily showing the structure 
of the first band dividing filter 100 in FIG. 4. In FIG. 5, the 
5 first band dividing filter 100 is provided with first to third 
two-band division portions 101 to 103. These first to third 
two-band division portions 101 to 103 are provided with one- 
dimensional low-pass filters (LPF) 111 to 113, one-dimensional 
i : 3 high-pass filters (HPF) 121 to 123, and down-samplers 131 to 133 

10 for LPFs and down-samplers 141 to 143 for HPFs for decimating the 
j;jt signal at a ratio of 2:1, respectively. 

!| The first two-band division portion 101 receives the 

* digital image signal 71, filters any horizontal component thereof 

l ! * through both the LPF 111 and HPF 121 , and then generates two signals 

j;^ 15 Thereafter, the first two-band division portion 101 decimates the 

M filtered signals at a ratio of 2:1, respectively, by using the 

down-samplers 131 and 141, and then outputs the signals to the 
next stage. The second two-band division portion 102 receives 
the signal from the down-sampler 131, and then filters any 
20 vertical component thereof through both the LPF 112 and HPF 122 . 
Then, the second two-band division portion 102 decimates the 
filtered signals at a ratio of 2:1, respectively, by using the 
down-samplers 132 and 142 , and then outputs two signals as signals 
LL1 and LH1 . The third two-band division portion 103 receives 
25 the signal from the down-sampler 141, and then filters any 
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vertical component thereof through both the LPF 113 and HPF 123. 
Then, the third two-band division portion 103 decimates the 
signals at a ratio of 2:1, respectively, by using the down- 
samplers 133 and 143, and then outputs two signals as signals HL1 
5 and HH1 . 

In this way, the first band dividing filter 100 outputs four 
signals, i.e. , the signal LL1 low in both horizontal and vertical 
components, the signal LH1 low in horizontal but high in vertical, 
the signal HL1 high in horizontal but low in vertical, and the 

10 signal HH1 high in both. Here, from the four signals outputted, 
transform coefficients constituting each signal are obtained. 
The s-econd and third band dividing filters 200 and 300 each carry 
out processing similar to the above for the incoming signals. 

As a result of the band dividing processing carried out by 

15 the above described first to third band dividing filters 100 to 
300 , the digital image signal 71 is divided into 10 signals varied 
in bands, that is, the signals LL3 , LH3 , HL3 , HH3, LH2 , HL2 , HH2 , 
LH1 , HL1 , and HH1 . FIG. 6 is a diagram illustrating these ten 
signals in a two-dimensional frequency region. Herein, the 

20 signal LL3 lowest in the frequency band is referred to as MRA 
(Multi-Resolution Approximation) , and the other signals LH3 , HL3 , 
HH3 , LH2 , HL2, HH2 , LH1 , HL1 , and HH1 , are referred to as MRR 
(Multi-Resolution Representation) . 

In FIG . 6 , the vertical axis represents a vertical frequency 

25 component, which becomes higher as is directed downward, and the 
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horizontal axis represents a horizontal frequency component, 
which becomes higher as is directed rightward. 

Each divided area in FIG. 6 is representing data in one frame 
of image, and a ratio between area sizes is equivalent to that 
5 between the number of data in the band signals. In detail, in 
a case where the number of data in the signals LL3 , LH3 , HL3 , and 
HH3 as the third hierarchical signal is "1", the number of data 
in the signals LH2 , HL2 , and HH2 as the second hierarchical signal 
r-g is "4 (2 by 2 in size)", and the number of data in the signals 

0 10 LH1 , HLl,and HH1 as the first hierarchical signal is "16 (4 by 

\3 4 in size) " . 

Fj For example, if one piece of data shown at the top-left of 

the LL3 signal area is for a certain number of pixels on the 
M original image, the same number of pixels is represented by one 

15 piece of data shown at the top-left of each of the LH3 , HL3 , and 
M HH3 signal areas. Similarly, the same number of pixels is 

represented by four pieces of data shown at the top-left of each 
of the LH2 , HL2 , and HH2 signal areas, and by sixteen pieces of 
data in the LH1 , HL2 , and HH1 signal areas, respectively (square 
20 portion filled in black in each signal area in FIG . 6). Therefore, 
in the drawing, 64 pieces of pixel data (8 by 8 in size) on the 
digital image signal (shown at the top-left) represents the same 
spatial region as that represented by the transform coefficients 
which are shown as black squares in all frequency bands. 
25 Next, the authentication data generation portion 12 




generates a pseudo-random number series by using a predetermined 
key data, and then generates authentication data from the 
pseudo-random number series (step S302). To be specific, the 
authentication data generation portion 12 determines whether the 
5 each of the real numbers in the generated pseudo-random number 
series is positive or negative, and if positive, regards a bit 
value as w l" , and if negative, regards a bit value as "0" to 
generate the authentication data. For example, authentication 
data AD is generated from a pseudo-random number series PN in the 

10 following manner. 

PN = {0.12, -0.23, -1.21, 0.23, 1.1, -0.34, 0.01, -0.51,..., -0.33} 
AD = { 1, 0, 0, 1, 1, 0, 1, 0, 0} 

The key data exemplarily includes information such as an 
initial value, a type of function for generation of a pseudo- 

15 random number series, and a bit length thereof. For 
simplification, in the present embodiment, assume that the key 
data is a value represented by the data length of 8-bit. Further, 
in the following explanation, it is assumed that the 
authentication data is a bit stream composed of binary bit values 

2 0 of w l" and "0". 

The key data is essential information for data embedment, 
and is also used for data extraction in the tamper detecting 
apparatus 2. It is therefore requested to determine, in advance, 
the key data between the tamper-detection-information embedding 

25 apparatus 1 and the tamper detecting apparatus 2. 
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Next, the key data embedding portion 13 reads the transform 
coefficients of MRA in the image signal divided by the band 
division portion 11 in a predetermined order, and then embeds the 
key data in the transform coefficients with a predetermined method 
5 (step S303) . Among various methods available for this embedment, 
the method disclosed in Japanese Patent Laid-Open Publication No. 
11-196262 (1999/196262) , which was proposed (applied) by the 
inventors of the present invention, achieves embedment with high 
accuracy and with less distortion in image quality . In the method , 

10 q is assumed to be a value obtained by dividing a transform 
coefficient by quantization step size Q, and is set to a nearest 
even or odd integer depending on a bit value of key data 
corresponding to the transform coefficient, thereby enabling the 
embedding of the key data. 

15 Note that the predetermined order for reading the transform 

coefficients of MRA is essential information for data embedment, 
and is also used for key data extraction in the tamper detecting 
apparatus 2. Here, the key data may be converted to digital 
information being encrypted for embedment. Alternatively, it is 

20 possible to add an error correction code to the key data before 
embedment. Further, if the number of bits of embedding digital 
information is smaller than the number of transform coefficients 
of MRA, every bit of the digital information is once embedded, 
and then the same bits are embedded again starting from the first 

25 bit. 



Next, processing carried out by the authentication data 
embedding portion 14 in FIG. 1 (step S304) is described by 
referring to FIG. 7, which is a flowchart exemplarily showing the 
processing . 

5 The authentication data embedding portion 14 reads 

transform coefficients Wi of the signal LH3 in FIG. 4 in a 
predetermined order from MRR of the image signal divided in the 
band division portion 11 (step S701) . The authentication data 
embedding portion 14 then determines whether or not an absolute 

10 value I Wi | of the read transform coefficient is not less than a 
predetermined set value T (step S702) . 

If the absolute value I Wi | is less than the set value T in 
step S702 , the authentication data embedding portion 14 sets the 
transform coefficient Wi to a predetermined value +m or -m 

15 depending on a bit value of authentication data corresponding to 
the transform coefficient (step S703) . Herein, the value m can 
be set at will as long as being not more than the set value T. 
The smaller the value m is, the better the deterioration in image 
quality becomes, but the less the protection against an external 

20 attack becomes. The larger the value m is, the better the 
protection against an external attack becomes, but the worse the 
deterioration in the image quality becomes due to the increase 
in amount of variation of transform coefficient. The value m thus 
may be appropriately set depending on the use of the apparatus 

25 and the level of the digital signal treated thereby. On the other 



hand, if the absolute value I Wi | is not less than the set value 
T in step S702, the authentication data embedding portion 14 sets, 
similarly to the key data embedding portion 13, q to a nearest 
even or odd integer depending on the bit value of authentication 
5 data corresponding to the transform coefficient (step S704). 
Here, q is assumed to be a value obtained by dividing a transform 
coefficient by quantization step size Q. 

In this way, bit values of the authentication data are 
embedded in the transform coefficients Wi, and thereby data- 

10 embedded transform coefficients Wi ' are generated. 

After completing the above processing for the signal LH3 , 
the authentication data embedding portion 14 reads the transform 
coefficients Wi of the signal LH2 in a predetermined order, and 
then repeats the processing in steps S701 to S704. 

15 Note that, although the processing is carried out first for 

the transform coefficients of the signal LH3 and then for the 
signal LH2 in this example, the order may be inverted. Further, 
the authentication data is not necessarily embedded in all 
transform coefficients Wi of the signals LH3 and LH2 , but may be 

20 embedded alternately in vertical and horizontal directions (refer 
explanation for the tamper detecting apparatus 2, which will be 
described later). In this manner, the deterioration in image 
quality caused by information embedment can be reduced. 

The order in which the signals LH2 and LH3 are treated and 

25 the predetermined order for reading the transform coefficients 
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thereof are essential information for data embedment, and are also 
used for data extraction in the tamper detecting apparatus 2 . 
Further, the set value T used for comparison may be set differently 
for the transform coefficients of the signal LH2 and the signal 
5 LH3 . The set value T for the signal LH3 is preferably set smaller 
than that for the signal LH2 . For example, the set value T is 
predetermined as "7" for the signal LH3 signal and as M 10" for 
the LH2 signal, and the value m is predetermined as "2". 

Next, by referring to FIGS. 8 and 9, processing carried out 

10 by the band synthesis portion 15 is described. 

FIG. 8 is a block diagram exemplarily showing the structure 
of the band synthesis portion 15 in FIG. 1. In FIG. 8, the band 
synthesis portion 15 is provided with first to third band 
synthesis filters 400, 500, and 600, all of which are identical 

15 in structure. 

These first to third band synthesis filters 400, 500, and 
600 each receive the four signals varied in frequency bands, and 
then synthesizes the signals to output as one signal (step S305) . 
The first band synthesis filter 400 receives the signals LL3 , LH3, 

20 HL3 , and HH3 , and then synthesizes these signals to generate the 
signal LL2 . The second band synthesis filter 500 receives the 
signals LL2 , LH2 , HL2 , and HH2 , and then synthesizes these signals 
to generate the signal LL1 . Thereafter, the third band synthesis 
filter 600 receives the signals LL1 , LH1, HL1 , and HH1, and then 

25 synthesizes these signals to reconstruct a digital image signal 
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72 . 

FIG. 9 is a block diagram exemplarily showing the structure 
of the first band synthesis filter 400 in FIG. 8. In FIG. 9, the 
first band synthesis filter 400 is provided with first to third 
5 two-band synthesis portions 401 to 403. These first to third 
two-band synthesis portions 401 to 403 are provided with LPFs 411 
to 413, HPFs 421 to 423, and up-samplers 431 to 433 for LPFs and 
up-samplers 441 to 443 for HPFs for inserting zero to the signal 
at a ratio of 2:1, and adders 451 to 453, respectively. 

10 The first two-band synthesis portion 401 receives the 

signals LL3 and LH3 , and then converts the signals into signals 
twice in magnitude by using the up-samplers 431 and 441, 
respectively. Then, the vertical component of the converted two 
signals is filtered through the LPF 411 and HPF 421 , respectively , 

15 and then the filtered two signals are added for output . The second 
band synthesis portion 402 receives the signals HL3 and HH3 , and 
then converts the signals into signals twice in magnitude by using 
the up-samplers 432 and 442, respectively. Thereafter, the 
vertical component of the converted two signals is filtered 

20 through the LPF 412 and HPF 422, respectively, and then the 
filtered two signals are added together for output. The third 
two-band synthesis portion 403 receives outputs from the adders 
451 and 452, and then respectively converts the outputs into 
signals twice in magnitude by using the up-samplers 433 and 443. 

25 Then, horizontal component of the converted two signals is 

29 



filtered through the LPH 413 and HPF 423, respectively and then 
the filtered two signals are added together for output. 

Accordingly, the first band synthesis filter 400 outputs 
the signal LL2 low in both horizontal and vertical components, 
5 that is, the second hierarchical signal. The second and third 
band synthesis filters 500 and 600 each carry out processing 
similar to the above for the incoming signals. In this way, the 
band synthesis portion 15 reconstructs 10 frequency band signals 
LL3, LH3, HL3 , HH3 , LH2 , HL2 , HH2 , LH1 , HL1 , and HH1 to the digital 

10 image signal 72 to which embedment has been done. 

Next, by referring to FIGS. 2 and 10 to 13, described is 
a method of tamper detection which is carried out by the tamper 
detecting apparatus 2 according to the embodiment. 

FIG. 10 is a flowchart showing processing carried out by 

15 the tamper detecting apparatus 2 of the embodiment. 

In FIG. 2, the band division portion 11 receives a digital 
image signal 73. The digital image signal 72 outputted from the 
band synthesis portion 15 of the tamper-detection-information 
embedding apparatus 1 becomes the digital image signal 73 due to 

20 compression/decompression or tampering during its transmission. 
The band division portion 11 subjects the received digital image 
signal 73 to discrete wavelet transform to divide the same into 
10 signals varied in frequency bands , i.e., signals LL3 , LH3 , HL3 , 
HH3, LH2 , HL2 , HH2 , LH1 , HL1 , and HH1, and obtains transform 

25 coefficients for every signal (step S1001). 




Next, the key data extraction portion 21 reads the transform 
coefficients of MRA in the image signal 73 divided by the band 
division portion 11 in the same order in which the transform 
coefficients are read by the key data embedding portion 13 of the 
5 tamper-detection-information embedding apparatus 1, and then 
extracts the key data embedded in the signal (step S1002) . Among 
various method available for this extraction, the method 
disclosed in the above described publication applied by the 
inventors of the present invention achieves extraction with high 

10 accuracy and with less distortion in image quality . In the method , 
q is assumed to be a value obtained by dividing a transform 
coefficient by quantization step size Q and then rounding off the 
result. A bit value of the embedded key data is extracted based 
on the determination whether q is an odd or even number. 

15 The key data determination portion 22 determines, for 

verification, whether or not the key data extracted by the key 
data extraction portion 21 is identical to the key data used by 
the tamper-detection-information embedding apparatus 1 (step 
S1003) . The determination is carried out by comparing the key 

20 data extracted in the key data extraction portion 21 with the key 
data previously held therein as that used in the tamper- 
detection-information embedding apparatus 1. Herein, if a 
plurality of key data is used by the tamper-detection-information 
embedding apparatus 1, the key data determination portion 22 

25 correspondingly holds the same data for comparison. 
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In step S1003, if the extracted key data is determined as 
identical to the key data previously held, the key data 
determination portion 22 carries out processing from step S1004 
and onwards. On the other hand, if the extracted key data is 
5 determined as not identical, the key data determination portion 
22 determines that the digital image signal 73 has been tampered 
with (step S1011) . 

The key data determination portion 22 is not an 
indispensable component to the tamper detecting apparatus 2 . In 

10 the present invention, however, such determination for verifying 
the key data improves reliability of the tamper detecting 
apparatus 2 in detection of tamper with the digital image. The 
key data determination portion 22 is therefore preferably used 
in view of making the tamper detecting apparatus 2 more preferable 

15 in practical use. 

The authentication data generation portion 12 generates, 
in the above described manner, a pseudo-random number series by 
using the key data previously held therein as the key data used 
by the tamper-detection-information embedding apparatus 1. 

20 The key data includes information such as an initial value, a type 
of function for generation of the pseudo-random number series, 
and a bit length thereof. The authentication data generation 
portion 12 then generates authentication data K from the 
pseudo-random number series (step S1004) . 

25 Next, processing carried out by the embedded information 
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extraction portion 23 in FIG. 2 (step S1005) is described by 
referring to FIG. 11, which is a flowchart exemplarily showing 
the processing. 

The embedded information extraction portion 23 reads the 
5 transform coefficients Wi of the signals LH3 and LH2 from MRR of 
the digital image signal 73 divided in the band division portion 
11 . Here , the transform coefficients Wi are read in the same order 
in which those are read by the authentication data embedding 
portion 14 of the tamper-detection-information embedding 

10 apparatus 1. To be specific, the transform coefficients Wi are 
read in the order of signal LH3 and then the signal LH2 , and also 
in the predetermined order within each signal (step S1101) . The 
embedded information extraction portion 23 then determines 
whether or not the absolute value |Wi| of the read transform 

15 coefficient is not less than the predetermined set value T (step 

51102) . 

If the absolute value |Wi| is less than the set value T in 
step S1102, the embedded information extraction portion 23 
further determines whether the value of the transform coefficient 
20 Wi is positive or negative. Based on the determination, the 
embedded information extraction portion 23 extracts a bit value 
of the information embedded in each transform coefficient (step 

51103) . On the other hand, if the absolute value I Wi | is not less 
than the set value T in step S1102, the embedded information 

25 extraction portion 23 extracts a bit value of the information 
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embedded in each coefficient with the similar method carried out 
by the key data extraction portion 21 (step S1104) . In the method, 
q is assumed to be a value obtained by dividing a transform 
coefficient by quantization step size Q and then rounding off the 
5 result . A bit value of the information embedded in each transform 
coefficient is extracted based on the determination whether q is 
an odd number or even number. 

By completing the above processing, the embedded 
information extraction portion 23 extracts embedded information 
10 D which is composed of the information embedded in each transform 
coefficient (step S1005) . The embedded information D 

corresponds to the authentication data assumed to have been 
embedded in the tamper-detection-information embedding 
apparatus 1 . 

15 Next, by referring to FIG. 12, processing carried out by 

the regional embedded information read portion 24 and the regional 
authentication data read portion 25 is described. In FIG. 12, 
the top-left dotted area shows a block serving as a unit for 
determining whether or not any tamper exists in the digital image 

20 signal 73 (hereinafter, referred to as unit block) . Here, the 
size of the unit block is exemplarily 32 by 32 pixels. Further, 
in FIG. 12, with respect to the signals LH3 and LH2 , transform 
coefficients representing the same spatial region as the unit 
block are shown in the frames drawn with the thick line. As is 

25 evident from the drawing, if the size of the unit block is 32 by 
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32 pixels for the digital image signal 73, corresponding block 
sizes for the signals LH3 and LH2 are 4 by 4 pixels and 8 by 8 
pixels , respectively . 

Note that the unit block size herein (32 by 32 pixels) is 
5 one example, and can be arbitrarily set depending on how small 
or large a unit (region) for determining the tamper is. 

Now, the description is exemplarily made for a case where 
the transform coefficients of the signals LH3 and LH2 are read 
alternately in vertical and horizontal directions . In this case , 

10 information has been embedded in the same manner by the 
tamper-detection-information embedding apparatus 1 . In this 
example, embedded information corresponding to the unit block of 
32 by 32 pixels is 4 pieces of data in the signal LH3 and 16 pieces 
of data in the signal LH2 ( f illed-in-black portions in FIG. 12) . 

15 Accordingly, the regional embedded information read 

portion 24 reads such 20 pieces of information from the embedded 
information D extracted in the embedded information extraction 
portion 23 as embedded information BD corresponding to the unit 
block of 32 by 32 pixels (step S1006) . 

20 Similarly, the regional authentication data read portion 

25 reads 20 pieces of authentication data corresponding in 
position to the embedded information BD from the authentication 
data K generated in the authentication data generation portion 
12 as authentication data BK corresponding to the unit block of 

25 32 by 32 pixels (step S1007) . 




Assume, for example, that the embedded information BD and 
the authentication data BK respectively read by the regional 
embedded information read portion 24 and the regional 
authentication data read portion 25 are 
5 BD={1, 0, 1,1, 1,0, 0, 1, 1, 0, 0, 1,1, 1, 0, 1, 0, 1,0, 1} 
BK - {1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1} 
Here, in comparison between both, the second, fourth, 
twelfth, and fourteenth bits differ in value from each other. 

Next, in the block-tamper determination portion 26, the 

10 bits at the same positional order in the embedded information BD 
and the authentication data BK are XORed, and then a sum total 
S of the XORed values is computed (step S1008) . FIG. 13 is a 
diagram exemplarily showing a computation under the XOR. The 
result of the computation becomes "1" when both bits differ in 

15 value from each other and becomes "0" when both are the same in 
value . The block-tamper determination part 2 6 compares the total 
sum S with a predetermined set value BT so as to determine whether 
a partial image corresponding to the unit block (in the example, 
32 by 32 pixels) has been tampered with or not (step S1009) . 

20 For example, the block-tamper determination portion 26 

determines that the image has been tampered with if the total sum 
S is not less than the set value BT, and has not been tampered 
with if the total sum S is less than the set value BT . The set 
value BT can be predetermined at will depending on how strictly 

25 the tamper determination is made . In such manner , the intentional 
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image tampering and the change caused by the irreversible image 
processing can be distinguished from each other. 

In the above exemplified embedded information BD and the 
authentication data BK, the bit values differ from each other in 
5 the four positions. As a result, the total sum S computed is "4". 
If the set value BT is predetermined as "3", the total sum S is 
not less than the set value BT . Accordingly, the unit block is 
determined to have been tampered with. 

The XOR computing carried out in the block-tamper 

10 determination portion 26 may take a reverse logic. That is, "0" 
is computed when both bits differ in value from each other and 
"1" when both are the same in value. In this case, the 
block-tamper determination portion 2 6 determines that the block 
has been tampered with if the total sum S is less than the set 

15 value BT, and not have been tampered with if not less. Instead 
of the total sum S of the XORed values, the number of or an inner 
product of bits that coincide with each other between the embedded 
information BD and the authentication data BK may be computed. 
Further alternatively, it is possible to substitute "-1" for "0" 

20 in the embedded information BD and the authentication data BK, 
and then compute an inner product thereof. 

Based on the determination in step S1009, the tamper 
detecting apparatus 2 stores in memory (not shown) or outputs to 
a display (not shown) either information that the unit block 

25 (within 32 by 32 pixels) has been tampered with or has not been 



tampered with (steps S1010, S1011) .. 

The tamper detecting apparatus 2 repeats the processing in 
steps S1006 to S1009 for all unit blocks to detects the position 
of the tampered portion on the digital image. 
5 As described above, according to the embodiment of the 

present invention, in the tamper-detection-information 
embedding apparatus 1, a digital image signal is hierarchically 
divided into three bands , and then the authentication data is 
embedded in the transform coefficients of the signals LH3 and LH2 

10 of MRR. The authentication data is generated from a pseudo-random 
number series by using the key data, and the key data is embedded 
in the transform coefficients of MRA. In the tamper detecting 
apparatus 2, the digital image is divided into unit blocks each 
composed of a predetermined number of pixels . For each unit block , 

15 information embedded in the transform coefficients of MRR that 
represents the same spatial region as the unit block is read. The 
read information is compared, for verification, with the 
authentication data assumed to have been embedded in the 
tamper-detection-information embedding apparatus 1 . 

20 In this way, the tamper detecting apparatus 2 can localize 

the tampered position on the digital image on a regional basis 
of unit block. Further, in the tamper-detection-information 
embedding apparatus 1 , the information is embedded in the 
transform coefficients of relatively low frequency components. 

25 Accordingly, even if the irreversible image processing is 




performed, variation in the embedded key data and authentication 
data is small comparing to that caused by the intentional image 
tampering. It is therefore possible to distinguish between the 
changes caused by the irreversible image processing and the 
5 intentional image tampering. Still further, according to a 
tamper-detection-information embedding method and a tamper 
detecting method of the present invention, it is not easy for a 
third party to decipher the authentication data because he/she 
does not know specifics of frequency bands and transform 
10 coefficients in which the information is embedded, the order of 
reading the transform coefficients, and the key data, thereby 
preventing overwriting or replacement of the embedded 
information . 

The number of hierarchies obtained by discrete wavelet 
15 transform carried out in the band division portion 11 of the 
embodiment is not limited to three. The signal can be divided 
into more hierarchies until the signal LL reaches a 1 by 1 element. 
Further, bands for embedding the authentication data is not 
limited to the signals LH3 and LH2 , but may be other bands among 
20 MRR or all bands of MRR. Even in these cases, the order in which 
the bands are subjected to processing should be predetermined. 

Note, however, the authentication data is preferably 
embedded only in the transform coefficients of the signals in 
deeper hierarchies in order to make the most of the usable effects 
25 of the present invention. Specifically in FIG. 4, it is most 
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preferable to embed the authentication data in some or all of the 
signals LH3 and HL3 as being the third hierarchical signal and/or 
the signals LH2 and HL2 as being the second hierarchical signal. 

Further, in the above described embodiment, the 
5 authentication data embedding portion 14 sequentially embeds the 
authentication data in each of the transform coefficients read 
in a predetermined order. For all transform coefficients of MRR 
that represents the same spatial region as the unit block , however , 
the same authentication data may be repeatedly embedded . 

10 Still further, if the key data is embedded after encryption 

using a public key or common key in the tamper-detection- 
information embedding apparatus 1 of the above described 
embodiment and the information encrypted and embedded is 
decrypted in the tamper detecting apparatus 2 , the public key or 

15 common key to be used should be predetermined between the 
apparatuses . 

The features achieved by the tamper-detection-information 
embedding apparatus 1 and the tamper detecting apparatus 2 of the 
above described embodiment are typically realized by a storage 
20 device (ROM, RAM, hard disk, etc.) storing predetermined program 
data and a CPU executing the program data. The program data may 
also be supplied via a storage medium (CD-ROM, floppy disk, etc.). 

While the invention has been described in detail, the 
foregoing description is in all aspects illustrative and not 
25 restrictive. It is understood that numerous other modifications 



and variations can be devised without departing from the scope 
of the invention. 



».3 

'-•I 

!•* 

n 
u 

H 

n 

M 

ri 



41 



